Posted
by
Unknown Lamer
on Tuesday August 12, 2014 @07:04AM
from the have-to-break-the-law-to-protect-the-law dept.

Via Ars Technica comes news that an Amtrak employee was paid nearly $900,000 over the last ten years to give the DEA passenger lists outside of normal channels. Strangely enough, the DEA already had access to such information through official channels. From the article: The employee, described as a "secretary to a train and engine crew" in a summary obtained by the AP, was selling the customer data without Amtrak's approval. Amtrak and other transportation companies collect information from their customers including credit card numbers, travel itineraries, emergency contact info, passport numbers, and dates of birth. When booking tickets online in recent years, Amtrak has also collected phone numbers and e-mail addresses. ... Amtrak has long worked closely with the DEA to track drug trafficking activity on its train lines. The Albuquerque Journal reported in 2001 that "a computer with access to Amtrak's ticketing information sits on a desk in the [DEA]'s local office," wrote the ACLU.

This sounds like a case of the left hand doesn't know what the right is doing. While neither collection method sounds constitutional to me I am not surprised.

Let's guess who gets in trouble...
The employee selling the data..check (low level scape goat)
Maybe an IT guy that allowed excessive permission.. maybe he just gets fired...
Any DEA agents or upper level management who authorized illegal and warrant-less data collection? NO
Any Amtrak executives for allowing it to be provided (through the employee or the terminal in the DEA office?) NO
If we are lucky we will hear some strong words at a congressional hearing, and that will be the end of it.

Or log avoidance. The secure access station probably keeps detailed logs which could be used to reveal fishing expeditions, an out-of-channels approach like this leaves no paper trail which could then come back to bit someone.

He's speculating that the drug traffickers might have paid an Amtrak IT person to tell them if they were being monitored. That's what he meant when he said "mole in Amtrak's organization."

It's a plausible idea, but hardly justifies the DEA's action (especially since, if the DEA suspected a mole, they surely wouldn't have failed to find and remove him in that ten-year period -- or if they did fail at that, then they're incompetent and don't deserve to exist anyway!).

He's speculating that the drug traffickers might have paid an Amtrak IT person to tell them if they were being monitored.

The drug trafficker's mole wouldn't tell them that the mules are specifically being monitored, but rather they'd submit false passenger data via the regional office system (or removing that data before it hits the main (DEA-linked) database.) The DEA'd be looking for differences between the two passenger lists, the one that reaches the official system, and the list in the regional office, to see if anyone in a regional office is playing with the data to hide traffic.

"The DEA's own mole was apparently limited to a single crew. So they'd only be able to check a small number of routes/trips at any given time."

Not at all necessarily so. The secretary had access to passenger data. There is no indication that the passenger data was linked to what crew she (or he) worked for - nor would it make sense to do so (why should Amtrak care who was driving a particular train?).

I really think it should be a matter for the OS as well. Something at the more base levels of operation that make note of WTF is happening and log it. The database can have its own stuff, but it should also tell the OS, which should encrypt this stuff so only the truly authorized personnel can see it.

Of course, that doesn't stop my 'mole' attack if the mole has that level of access.

I'm currently on "Oh, look, turns out my own stuff is fairly compromised because of this same scenario, and I sit here wondering how other companies are suddenly popping out with ideas I discuss internally with mine" panic mode. Thanks.

Freedom of movement is not freedom if it does not apply to all equally.

Like people on GPS bracelets to ensure they do not leave the state.

Doesn't matter about "They're fleeing justice!" FREEDOM OF MOVEMENT. Even fucking MEXICO got this right and it's not even explicitly stated (it's hidden as the right to seek liberty, which is why you bust out of Mexican jail, they can't charge you with another crime. Proof? Yea, check my international criminal record. Alex McQuown, 1982. Ain't but one of me from that yea

Freedom of movement is not freedom if it does not apply to all equally.

Like people on GPS bracelets to ensure they do not leave the state.

I was under the impression that people were only required to wear GPS bracelets when they were on probation (or maybe on bond), as a "nicer" alternative to jail. Are you trying to claim that some people are being forced to wear GPSs in circumstances other than being ordered to do so by a court, or are you trying to claim that probation and/or bail are unconstitutional?

It takes a judge's decision — as the terms of your release before trial. Judiciary can suspend your rights. Executive should not be able to — but, in the case of travel, they do just that with the "no-fly" lists. Which was my point.

The bracelets are an alternative to being in jail — having your freedoms suspended by the Judiciary, not Executive. Executive can arrest you — limiting your freedoms temporarily — but they can not deprive a citizen of his rights for very long without a successful a successful trial.

Try again when you have been around the world, checked out the laws and rights enshrined within those laws, been arrested under those laws

We already have freedom of movement, which is enshrined in the Constitution, as interpreted by case law.

What we don't have is freedom of anonymous movement.

The law doesn't state you have freedom to use any means of transport available. You can be banned from airlines, trains, buses, and your rights technically aren't infringed because you can still walk or drive your car (assuming it's fully legal), or hitch a ride in a friend's vehicle.

So yeah, you have freedom of movement without regards to practicality.

The law doesn't state you have freedom to use any means of transport available. You can be banned from airlines, trains, buses, and your rights technically aren't infringed because you can still walk

If the First Amendment were interpreted this way, you could be banned from using newspapers or radio for your speech — and it would not have been an infringement, because you can still talk to your friends...

drive your car

Nope, that still requires a "driver's license" — a government's permission to d

We already have freedom of movement [wikipedia.org], which is enshrined in the Constitution, as interpreted by case law.

In that case, the "no-fly" lists are, indeed, unconstitutional — and the ACLU are asleep at the wheel. Perhaps, having aligned themselves over the past decades with the Far Left of the American politics, they don't want to further hamper a Far Left President... Or, maybe, they are just disorganized and lacking decent members and funds — as eventually befalls all Far Left organi

The mere freedom of association includes by pretext the right to travel to associate.

A very explicitly spelled-out right to "keep and bear arms" is readily infringed upon all over the nation. Even the most liberal locales — like Texas — require you to obtain a license. And it can be suspended even there upon a mere accusation of a crime [texaschl.us].

In less liberal locales — like New York — the Executive can withdraw the license at any moment and for any reason — or without reason at all

I would say it would be against the Fourth Amendment as I would say it is an unreasonable search

Oh, but "reasonable" is a term with such a wide interpretation, you drive a train through it — sideways...

Just ask a European what they think privacy is and you will see that it is much more that just the stuff you do at home when you are alone. It inclused everything you do and what defines you as a person. That is the startingpoint.

Where do you get that "can't board anonymously in Europe"? I do at least once a week, and millions do every day. The only check is that I'm carrying a valid ticket which I may have paid cash for 5 minutes before getting on the train with no ID (though long distance travel is considerably cheaper if you buy your ticket at least the day before).

Given all the ridicules and bullshit mental gymnastics the government does all the time to argue they can do clearly unconstitutional things like compel you to use your private property to purchase a service you may not want; its not hard to construct a right to travel. In fact I think the right to travel is actually pretty clear.

We have a first amendment right to peaceful assembly. In order to assemble one must be able to go to that place the assembly is taking place. (1) this should establish a basic r

It is even less hard — for the government — to construct the opposite. In fact, they already did — the no-fly lists exist...

Take a look at the Second Amendment — the right to "keep and bear arms" does not need to be constructed or otherwise derived — it is explicitly listed. And what? Even in the most liberal places — like Texas — you must have a license for it. Which means, it is not a right, but merely a privilege...

Actually, if the employee was selling Amtrak's proprietary information without Amtrak's consent and was keeping the money, they are guilty of embezzlement and DEA employees may be guilty of crimes related to arranging that activity, e.g. conspiracy or solicitation.

If the employee was selling Amtrak's proprietary information and giving the money to Amtrak, the DEA was breaching its contract with Amtrak. The DEA has to share the proceeds of drug busts based on information that comes from Amtrak with Amtrak,

Key questions include:
a. what budget line item did the $900K come from?;
b. what did the funding justification documentation look like?; and,
c. at what level was this approved, and by whom?
If DEA has so much money laying about that they can toss it around without adult supervision, then I suggest that there may be some oversight committees who might want to have some hearings.

I am sure it came from all the property the cease without any kind of due process. The DEA like the NSA is so out of control and so culturally broken the ONLY viable solution is complete dissolution of the agency. The cancer is so bad just outright killing the patient is the best outcome; we can't fix'em.

Honestly we need a whole house cleaning of these two agencies (to start with) that includes pretty much anyone who has greater role than sweeping the floors or brewing coffee. Every last 'analyst' every

Thing is, the NSA and the DEA both do a lot of legitimately essential work across a number of important areas. Notwithstanding any argument whether in DEA's case there might be redundancy as one of many special focus law enforcement agencies, NSA performs some unique missions nobody else does, like crypto production, for example, or performs to the same level, like coordinating foreign focused Signals Intelligence among and serving the Military branches. Also, NSA itself is so stove-piped that even if one a

Maybe it's just a case of what the news industry calls "independent verification". Of course, the way it typically works is that the original source X passes copies to friends Y and Z, who slightly paraphrase the wording and send it in to the news organization through different channels. X, Y and Z then all get paid for their work.
Governmental information agencies have long understood how this "verification" process works.

I'm surprised their are passenger trains at all in other parts of the country... Here in PA, Philly I think is the only city with passenger train service through Amtrak. Oh sure, we have lots of rail lines (I drive over 6 sets of tracks every day), but those are exclusively industrial transportation and not passenger lines...

I'm surprised their are passenger trains at all in other parts of the country... Here in PA, Philly I think is the only city with passenger train service through Amtrak. Oh sure, we have lots of rail lines (I drive over 6 sets of tracks every day), but those are exclusively industrial transportation and not passenger lines...

Amtrak runs over CSX/NS/UP/etc.-owned trackage with infinite-length trackage rights (i.e. ability to travel over "foreign" rail) due to the US government taking over the (failing) passenger rail service from the former large railroads (NKP, PRR, NYC, etc.) in 1971.

From now on, if somebody-somewhere-for some reason, keeps records of my comings, goings, and preferences, I will be under the assumption some governmental 3 letter acronym has instant access to this information.

Articles such as this will henceforth only be of interest to me if they include examples where my data is not collected.

Yes. The Constitution enumerates what the governement is allowed to do. It doesn't say it's allowed to track citizens. That means the Feds aren't allowed to do it. (It says nothing, however, about what the states are allowed to do.)

Sounds like someone was circumventing controls. The DEA had access... but did everyone in the DEA have access? I doubt it. One department likely had the data and getting to it either required evidence some didn't want to bother with, or was political, or maybe involved transferring money from your department to the controlling department. I've seen businesses where IS has control of an application, but what they claimed it cost per license was high enough that another department went out and bought the appl

I see this as very similar to the parallel construction method. The DEA likely has controls on the information and logs requests to see it, by paying the Amtrak employee separately they can argue they never looked at the passenger information because it's not logged in the request. The defense can't say they used improper search methods because the log shows they never accessed it.

I'd be willing to be someone is in jail right now because of this information being accessed outside normal channels and had the

That was my first thought before reading the article. Pay the employee, no hassle and red rape to worry about getting caught up in. However, FTFA:

Under a joint drug enforcement task force that includes the DEA and Amtrakâ(TM)s own police agency, the task force can obtain Amtrak confidential passenger reservation information at no cost, the inspector generalâ(TM)s report said. Under an agreement, Amtrak police would receive a share of any money seized as a result of such drug task force investigations, and Amtrakâ(TM)s inspector general concluded that DEAâ(TM)s purchase of the passenger information deprived the Amtrak Police Department of money it would have received from resulting drug arrests.

So it may simply be that there was a lot of money to be made by screwing Amtrak out of it.

This is probably rather controversial, but it should be said. The DEA was never created in order to police drugs.
Richard Nixon created the DEA in part as a reaction to the 60's neo liberal counter culture, and in part at the behest of southern constituents in response to the 1964 civil rights amendment. this is evidenced by the fact that the DEA targets disproportionally minority communities for enforcement, regardless of the well documented fact that affluent communities exhibit similar levels of drug posession. its also supported by the lack of any DEA presence or investigation during the iran contra scandal as well as the existence of numerous politicians and heads of state whom have repeatedly divulged their consumption of narcotics despite our nations zero tolerance policy.

as the push for drug sentencing reform continues, the DEA is finding itself increasingly useless as anything but an obstructionist wing of the government clinging for federal dollars. Blowing a million dollars on an amtrak mole despite existing access is just one example, but their raids on California dispensaries and legislative obstructionism shouldnt be ignored.
https://en.wikipedia.org/wiki/... [wikipedia.org]

You realize those California dispensaries may be legal according to state law. but run afoul of federal law because of the federal prohibition on drugs.

because? i don't know why...why did it take a constitutional amendment to ban alcohol but did not require one for other drugs?i believe they often use the interstate commerce clause...but if the state views it as legal and it never crossed state lines, then it seems the fed's shouldn't be able to touch it.

Uh, speaking as a former member of a few of those collectives, you do realize that they were operating outside of state law? That very same set of laws that the FG said they'd not interfere in unless it hit federal territory? Do you not realize most of these busted places were running a for-profit organization, in violation of STATE LAW?

What happens when state law is heavily violated? State doesn't prosecute, the Fed

I don't see how controversial it can really be, given that there's ample evidence for it. This book [amazon.com] dedicates a whole chapter to the formation of DEA and other related actions (introduction of no-knock raids, for example) of the Nixon administration, plotting the timeline against the political rhetoric.

Amtrak [wikipedia.org] is publicly funded. So the issue of whether theft was involved or it was an instance of interagency data sharing might be a bit cloudy.

Certainly this sort of transaction shoud be covered in Amtrak's corporate policies and procedures. I seriously doubt a low level employee could engage in such activity without approval from higher up. On the other hand, the absense such policies is a sure sign of bad management.

1) Purchase ticket using unique email address.2) Almost immediately receive spam to that email address from a spoofed source.3) Realize Amtrack is (knowingly or unknowingly) selling your personal contact information to anyone who will pay.

It makes sense that if this Amtrack employee was selling the customer contact info database illegally to the DEA there likely were other buyers too that are much harder to catch in the act. Furthermore it makes sense that if the DEA would spe

Bigoted against tranny prostitites? On government transportation that the public rides on? HELL, yes. Publicly visited transport should be free of this filth. You're a complete fucktard for thinking this is not completely fucking disgusting and actually supporting it's actions. Just because some assclown wants to pretend it's a woman, that certainly means that it isn't. Get that seedy shit off of national transportation that people have to pay to be on. Clown.

That's just amazing. Any company I've worked for, I'd be strung up by the heels for giving away customer data, let alone selling it for the better part of a million dollars. One article notes "It was not clear whether the DEA has rules against soliciting corporate insiders to provide confidential customer information in exchange for money." Really, they need a specific rule against that? I can see a DEA official whispering in someone's ear "Shut up, shut up, let it go and just let her retire."

Amtrak is just a one source, of many. Intelligence agencies not only get the information, but also get this information via different channels to have redundancy and to verify those copies against each other. Sources do not know about each other. That is basic rule in operations against the enemy. To begin with, most likely Amtrak serves have been hacked by NSA long time ago and they have the information directly. In addition to that they have insiders, on the payroll, to get the same data as well as interp